@serfab/cadre-host 0.10.0 → 0.12.0

package/src/nat/secrets/keytar-store.ts

@@ -1,67 +1,67 @@
-import debug from 'debug';
-
-import { NatError } from '../types.js';
-import type { KeytarLike, SecretsStore } from './index.js';
-
-const log = debug('cadre:host:nat-secrets:keytar');
-
-/**
- * SecretsStore backed by the OS keychain via the `keytar` npm package.
- *
- * The keytar module is injected (rather than imported here) so:
- *   - The native dependency is loaded lazily by `createSecretsStore` and
- *     unavailable platforms fall through cleanly to the file store.
- *   - Unit tests can stub the entire keytar surface.
- */
-export class KeytarSecretsStore implements SecretsStore {
-  constructor(
-    private readonly service: string,
-    private readonly keytar: KeytarLike,
-  ) {}
-
-  async set(account: string, value: string): Promise<void> {
-    try {
-      await this.keytar.setPassword(this.service, account, value);
-    } catch (err) {
-      throw new NatError(
-        'secrets_unavailable',
-        `keytar setPassword failed: ${(err as Error).message}`,
-      );
-    }
-  }
-
-  async get(account: string): Promise<string | null> {
-    try {
-      return await this.keytar.getPassword(this.service, account);
-    } catch (err) {
-      throw new NatError(
-        'secrets_unavailable',
-        `keytar getPassword failed: ${(err as Error).message}`,
-      );
-    }
-  }
-
-  async delete(account: string): Promise<boolean> {
-    try {
-      return await this.keytar.deletePassword(this.service, account);
-    } catch (err) {
-      throw new NatError(
-        'secrets_unavailable',
-        `keytar deletePassword failed: ${(err as Error).message}`,
-      );
-    }
-  }
-
-  async list(): Promise<string[]> {
-    try {
-      const creds = await this.keytar.findCredentials(this.service);
-      log('keytar findCredentials returned %d entries', creds.length);
-      return creds.map((c) => c.account);
-    } catch (err) {
-      throw new NatError(
-        'secrets_unavailable',
-        `keytar findCredentials failed: ${(err as Error).message}`,
-      );
-    }
-  }
-}
+import debug from 'debug';
+
+import { NatError } from '../types.js';
+import type { KeytarLike, SecretsStore } from './index.js';
+
+const log = debug('cadre:host:nat-secrets:keytar');
+
+/**
+ * SecretsStore backed by the OS keychain via the `keytar` npm package.
+ *
+ * The keytar module is injected (rather than imported here) so:
+ *   - The native dependency is loaded lazily by `createSecretsStore` and
+ *     unavailable platforms fall through cleanly to the file store.
+ *   - Unit tests can stub the entire keytar surface.
+ */
+export class KeytarSecretsStore implements SecretsStore {
+  constructor(
+    private readonly service: string,
+    private readonly keytar: KeytarLike,
+  ) {}
+
+  async set(account: string, value: string): Promise<void> {
+    try {
+      await this.keytar.setPassword(this.service, account, value);
+    } catch (err) {
+      throw new NatError(
+        'secrets_unavailable',
+        `keytar setPassword failed: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  async get(account: string): Promise<string | null> {
+    try {
+      return await this.keytar.getPassword(this.service, account);
+    } catch (err) {
+      throw new NatError(
+        'secrets_unavailable',
+        `keytar getPassword failed: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  async delete(account: string): Promise<boolean> {
+    try {
+      return await this.keytar.deletePassword(this.service, account);
+    } catch (err) {
+      throw new NatError(
+        'secrets_unavailable',
+        `keytar deletePassword failed: ${(err as Error).message}`,
+      );
+    }
+  }
+
+  async list(): Promise<string[]> {
+    try {
+      const creds = await this.keytar.findCredentials(this.service);
+      log('keytar findCredentials returned %d entries', creds.length);
+      return creds.map((c) => c.account);
+    } catch (err) {
+      throw new NatError(
+        'secrets_unavailable',
+        `keytar findCredentials failed: ${(err as Error).message}`,
+      );
+    }
+  }
+}

package/src/nat/types.ts

@@ -1,159 +1,159 @@
-/**
- * NAT/DDNS types for cadre-host.
- *
- * cadre-host runs on home/SMB machines that are typically behind NAT. To be
- * dialable from the open internet the host must:
- *   1. Punch a port forward on the upstream router (UPnP/NAT-PMP).
- *   2. Detect its external IP (and whether it's behind CGNAT).
- *   3. Optionally publish a stable hostname via dynamic DNS.
- *
- * State for these three concerns lives in `<rootDir>/nat.json` (user settings)
- * and is exposed as a single `NatStatusSnapshot` to the management UI.
- *
- * Credentials for DDNS providers are NOT stored in `nat.json`. They go through
- * the SecretsStore (keytar, with a 0600 file fallback).
- */
-
-/** Port-forwarding mode currently in effect. */
-export type PortForwardMode =
-  | 'auto-upnp'
-  | 'auto-natpmp'
-  | 'manual'
-  | 'failed'
-  | 'disabled';
-
-/** Reachability verdict — best-effort heuristic until AutoNAT lands. */
-export type DirectReachability = 'reachable' | 'unreachable' | 'unknown' | 'cgnat';
-
-/** Snapshot returned to the management UI / CLI. */
-export interface NatStatusSnapshot {
-  // Port forwarding
-  portMode: PortForwardMode;
-  externalPort: number;
-  internalPort: number;
-  /** IP the router reports as its WAN address. Null when not auto-mapped. */
-  routerExternalIp: string | null;
-  /** ISO timestamp when the current mapping lease expires. */
-  mappingLeaseExpiresAt: string | null;
-
-  // External IP (from public probe; may differ from routerExternalIp under CGNAT)
-  externalIp: string | null;
-  externalIpDetectedAt: string | null;
-  cgnatDetected: boolean;
-
-  // Reachability verdict
-  directReachability: DirectReachability;
-  lastTestedAt: string | null;
-
-  // DDNS
-  ddns: NatDdnsStatus;
-}
-
-/** DDNS sub-section of the status snapshot. */
-export interface NatDdnsStatus {
-  /** Provider ID (e.g. "duckdns"), null when no DDNS is configured. */
-  providerId: string | null;
-  /** Configured hostname (e.g. "foo.duckdns.org"), null when unconfigured. */
-  hostname: string | null;
-  /** True when the user opted out of cadre-host updating the record. */
-  externallyManaged: boolean;
-  /** Last attempt timestamp (ISO), null until first attempt. */
-  lastUpdateAt: string | null;
-  /** Whether the most recent attempt succeeded. */
-  lastUpdateOk: boolean | null;
-  /** Most recent error message, null when last attempt succeeded. */
-  lastError: string | null;
-}
-
-/**
- * On-disk shape of `nat.json`. NEVER contains DDNS credentials — those live
- * in the SecretsStore.
- */
-export interface NatSettingsFile {
-  version: 1;
-  /** External port to map (and announce). Default 4001. */
-  externalPort: number;
-  /** Internal libp2p port. Default 4001. */
-  internalPort: number;
-  /** Whether to attempt UPnP/NAT-PMP at all. */
-  upnpEnabled: boolean;
-  ddns: NatDdnsSettings;
-}
-
-/** DDNS sub-section of `nat.json`. */
-export interface NatDdnsSettings {
-  /** Provider ID (e.g. "duckdns"). Null = unconfigured. */
-  providerId: string | null;
-  /** Hostname to publish. Null = unconfigured. */
-  hostname: string | null;
-  /**
-   * True means the user maintains the DNS record themselves (e.g. via the
-   * provider's own auto-update agent on the router). cadre-host shows the
-   * hostname but never tries to update it.
-   */
-  externallyManaged: boolean;
-  /** DDNS update interval in milliseconds. Default 5 min. */
-  intervalMs: number;
-}
-
-/** Typed error codes for NatError. */
-export type NatErrorCode =
-  | 'mapping_failed'
-  | 'router_unreachable'
-  | 'ip_detection_failed'
-  | 'ddns_provider_unknown'
-  | 'ddns_credentials_missing'
-  | 'ddns_update_failed'
-  | 'secrets_unavailable'
-  | 'storage_error'
-  | 'invalid_config'
-  /** The owner node's admin channel is unreachable / not ready. */
-  | 'node_unavailable';
-
-/** Typed error carrying a stable `code` for HTTP mapping in the local-ui. */
-export class NatError extends Error {
-  readonly code: NatErrorCode;
-
-  constructor(code: NatErrorCode, message: string) {
-    super(message);
-    this.name = 'NatError';
-    this.code = code;
-  }
-}
-
-/** Description of a configurable field on a DDNS provider. */
-export interface DdnsConfigField {
-  /** Field key (e.g. "token"). */
-  key: string;
-  /** Human-readable label (e.g. "DuckDNS token"). */
-  label: string;
-  /** True if the value is a credential that must be stored in the SecretsStore. */
-  secret: boolean;
-}
-
-/** Summary of a DDNS provider for UI / CLI listing. */
-export interface DdnsProviderInfo {
-  id: string;
-  displayName: string;
-  configFields: ReadonlyArray<DdnsConfigField>;
-}
-
-/**
- * Typed HTTP handlers exposed to `cadre-host-local-ui` for Fastify wiring.
- *
- * Like TrustCircleHandlers, these take typed objects and either return typed
- * results or throw a `NatError` whose `.code` the UI ticket maps to an HTTP
- * status code.
- */
-export interface NatHandlers {
-  getStatus(): Promise<NatStatusSnapshot>;
-  testReachability(): Promise<NatStatusSnapshot>;
-  listDdnsProviders(): Promise<DdnsProviderInfo[]>;
-  putDdns(body: {
-    providerId: string;
-    hostname: string;
-    config: Record<string, string>;
-    externallyManaged?: boolean;
-  }): Promise<NatStatusSnapshot>;
-  putSettings(body: Partial<Omit<NatSettingsFile, 'version'>>): Promise<NatStatusSnapshot>;
-}
+/**
+ * NAT/DDNS types for cadre-host.
+ *
+ * cadre-host runs on home/SMB machines that are typically behind NAT. To be
+ * dialable from the open internet the host must:
+ *   1. Punch a port forward on the upstream router (UPnP/NAT-PMP).
+ *   2. Detect its external IP (and whether it's behind CGNAT).
+ *   3. Optionally publish a stable hostname via dynamic DNS.
+ *
+ * State for these three concerns lives in `<rootDir>/nat.json` (user settings)
+ * and is exposed as a single `NatStatusSnapshot` to the management UI.
+ *
+ * Credentials for DDNS providers are NOT stored in `nat.json`. They go through
+ * the SecretsStore (keytar, with a 0600 file fallback).
+ */
+
+/** Port-forwarding mode currently in effect. */
+export type PortForwardMode =
+  | 'auto-upnp'
+  | 'auto-natpmp'
+  | 'manual'
+  | 'failed'
+  | 'disabled';
+
+/** Reachability verdict — best-effort heuristic until AutoNAT lands. */
+export type DirectReachability = 'reachable' | 'unreachable' | 'unknown' | 'cgnat';
+
+/** Snapshot returned to the management UI / CLI. */
+export interface NatStatusSnapshot {
+  // Port forwarding
+  portMode: PortForwardMode;
+  externalPort: number;
+  internalPort: number;
+  /** IP the router reports as its WAN address. Null when not auto-mapped. */
+  routerExternalIp: string | null;
+  /** ISO timestamp when the current mapping lease expires. */
+  mappingLeaseExpiresAt: string | null;
+
+  // External IP (from public probe; may differ from routerExternalIp under CGNAT)
+  externalIp: string | null;
+  externalIpDetectedAt: string | null;
+  cgnatDetected: boolean;
+
+  // Reachability verdict
+  directReachability: DirectReachability;
+  lastTestedAt: string | null;
+
+  // DDNS
+  ddns: NatDdnsStatus;
+}
+
+/** DDNS sub-section of the status snapshot. */
+export interface NatDdnsStatus {
+  /** Provider ID (e.g. "duckdns"), null when no DDNS is configured. */
+  providerId: string | null;
+  /** Configured hostname (e.g. "foo.duckdns.org"), null when unconfigured. */
+  hostname: string | null;
+  /** True when the user opted out of cadre-host updating the record. */
+  externallyManaged: boolean;
+  /** Last attempt timestamp (ISO), null until first attempt. */
+  lastUpdateAt: string | null;
+  /** Whether the most recent attempt succeeded. */
+  lastUpdateOk: boolean | null;
+  /** Most recent error message, null when last attempt succeeded. */
+  lastError: string | null;
+}
+
+/**
+ * On-disk shape of `nat.json`. NEVER contains DDNS credentials — those live
+ * in the SecretsStore.
+ */
+export interface NatSettingsFile {
+  version: 1;
+  /** External port to map (and announce). Default 4001. */
+  externalPort: number;
+  /** Internal libp2p port. Default 4001. */
+  internalPort: number;
+  /** Whether to attempt UPnP/NAT-PMP at all. */
+  upnpEnabled: boolean;
+  ddns: NatDdnsSettings;
+}
+
+/** DDNS sub-section of `nat.json`. */
+export interface NatDdnsSettings {
+  /** Provider ID (e.g. "duckdns"). Null = unconfigured. */
+  providerId: string | null;
+  /** Hostname to publish. Null = unconfigured. */
+  hostname: string | null;
+  /**
+   * True means the user maintains the DNS record themselves (e.g. via the
+   * provider's own auto-update agent on the router). cadre-host shows the
+   * hostname but never tries to update it.
+   */
+  externallyManaged: boolean;
+  /** DDNS update interval in milliseconds. Default 5 min. */
+  intervalMs: number;
+}
+
+/** Typed error codes for NatError. */
+export type NatErrorCode =
+  | 'mapping_failed'
+  | 'router_unreachable'
+  | 'ip_detection_failed'
+  | 'ddns_provider_unknown'
+  | 'ddns_credentials_missing'
+  | 'ddns_update_failed'
+  | 'secrets_unavailable'
+  | 'storage_error'
+  | 'invalid_config'
+  /** The owner node's admin channel is unreachable / not ready. */
+  | 'node_unavailable';
+
+/** Typed error carrying a stable `code` for HTTP mapping in the local-ui. */
+export class NatError extends Error {
+  readonly code: NatErrorCode;
+
+  constructor(code: NatErrorCode, message: string) {
+    super(message);
+    this.name = 'NatError';
+    this.code = code;
+  }
+}
+
+/** Description of a configurable field on a DDNS provider. */
+export interface DdnsConfigField {
+  /** Field key (e.g. "token"). */
+  key: string;
+  /** Human-readable label (e.g. "DuckDNS token"). */
+  label: string;
+  /** True if the value is a credential that must be stored in the SecretsStore. */
+  secret: boolean;
+}
+
+/** Summary of a DDNS provider for UI / CLI listing. */
+export interface DdnsProviderInfo {
+  id: string;
+  displayName: string;
+  configFields: ReadonlyArray<DdnsConfigField>;
+}
+
+/**
+ * Typed HTTP handlers exposed to `cadre-host-local-ui` for Fastify wiring.
+ *
+ * Like TrustCircleHandlers, these take typed objects and either return typed
+ * results or throw a `NatError` whose `.code` the UI ticket maps to an HTTP
+ * status code.
+ */
+export interface NatHandlers {
+  getStatus(): Promise<NatStatusSnapshot>;
+  testReachability(): Promise<NatStatusSnapshot>;
+  listDdnsProviders(): Promise<DdnsProviderInfo[]>;
+  putDdns(body: {
+    providerId: string;
+    hostname: string;
+    config: Record<string, string>;
+    externallyManaged?: boolean;
+  }): Promise<NatStatusSnapshot>;
+  putSettings(body: Partial<Omit<NatSettingsFile, 'version'>>): Promise<NatStatusSnapshot>;
+}

package/src/orchestrator/__tests__/node-identity.test.ts

@@ -1,62 +1,62 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { ensureNodeIdentity, nodeIdentityPath } from '../node-identity.js';
-
-describe('ensureNodeIdentity', () => {
-  let tmp: string;
-
-  beforeEach(() => {
-    tmp = mkdtempSync(join(tmpdir(), 'cadre-node-id-'));
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('generates an identity inside the workdir on first call', async () => {
-    const { path, peerId } = await ensureNodeIdentity(tmp);
-    expect(path).toBe(nodeIdentityPath(tmp));
-    expect(path).toBe(join(tmp, 'identity.key'));
-    expect(peerId).toMatch(/^12D3Koo/);
-    expect(statSync(path).size).toBeGreaterThan(0);
-  });
-
-  // Reuse — not rotation — is the load-bearing property: a re-spawn of the same
-  // container must land on the same peer id or the cadre that admitted it sees a
-  // stranger.
-  it('reuses the existing key on a second call', async () => {
-    const first = await ensureNodeIdentity(tmp);
-    const bytesBefore = readFileSync(first.path);
-
-    const second = await ensureNodeIdentity(tmp);
-    expect(second.peerId).toBe(first.peerId);
-    expect(readFileSync(second.path).equals(bytesBefore)).toBe(true);
-  });
-
-  it('creates the workdir when it does not exist yet', async () => {
-    const workdir = join(tmp, 'nested', 'donated-1');
-    const { path, peerId } = await ensureNodeIdentity(workdir);
-    expect(path).toBe(join(workdir, 'identity.key'));
-    expect(peerId).toMatch(/^12D3Koo/);
-  });
-
-  // A key that is present but unreadable must FAIL the spawn, not fall through
-  // to `generateIdentity`. Regenerating would hand the cadre a stranger under
-  // the same containerId — silently reproducing the bug this module exists to
-  // fix — where a throw surfaces the damaged file to the operator.
-  it('throws rather than re-keying when the existing file does not decode', async () => {
-    const path = nodeIdentityPath(tmp);
-    writeFileSync(path, 'not a protobuf private key', 'utf8');
-
-    await expect(ensureNodeIdentity(tmp)).rejects.toThrow();
-    expect(readFileSync(path, 'utf8')).toBe('not a protobuf private key');
-  });
-
-  it.runIf(process.platform !== 'win32')('persists with mode 0600 on POSIX', async () => {
-    const { path } = await ensureNodeIdentity(tmp);
-    expect(statSync(path).mode & 0o777).toBe(0o600);
-  });
-});
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { ensureNodeIdentity, nodeIdentityPath } from '../node-identity.js';
+
+describe('ensureNodeIdentity', () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), 'cadre-node-id-'));
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('generates an identity inside the workdir on first call', async () => {
+    const { path, peerId } = await ensureNodeIdentity(tmp);
+    expect(path).toBe(nodeIdentityPath(tmp));
+    expect(path).toBe(join(tmp, 'identity.key'));
+    expect(peerId).toMatch(/^12D3Koo/);
+    expect(statSync(path).size).toBeGreaterThan(0);
+  });
+
+  // Reuse — not rotation — is the load-bearing property: a re-spawn of the same
+  // container must land on the same peer id or the cadre that admitted it sees a
+  // stranger.
+  it('reuses the existing key on a second call', async () => {
+    const first = await ensureNodeIdentity(tmp);
+    const bytesBefore = readFileSync(first.path);
+
+    const second = await ensureNodeIdentity(tmp);
+    expect(second.peerId).toBe(first.peerId);
+    expect(readFileSync(second.path).equals(bytesBefore)).toBe(true);
+  });
+
+  it('creates the workdir when it does not exist yet', async () => {
+    const workdir = join(tmp, 'nested', 'donated-1');
+    const { path, peerId } = await ensureNodeIdentity(workdir);
+    expect(path).toBe(join(workdir, 'identity.key'));
+    expect(peerId).toMatch(/^12D3Koo/);
+  });
+
+  // A key that is present but unreadable must FAIL the spawn, not fall through
+  // to `generateIdentity`. Regenerating would hand the cadre a stranger under
+  // the same containerId — silently reproducing the bug this module exists to
+  // fix — where a throw surfaces the damaged file to the operator.
+  it('throws rather than re-keying when the existing file does not decode', async () => {
+    const path = nodeIdentityPath(tmp);
+    writeFileSync(path, 'not a protobuf private key', 'utf8');
+
+    await expect(ensureNodeIdentity(tmp)).rejects.toThrow();
+    expect(readFileSync(path, 'utf8')).toBe('not a protobuf private key');
+  });
+
+  it.runIf(process.platform !== 'win32')('persists with mode 0600 on POSIX', async () => {
+    const { path } = await ensureNodeIdentity(tmp);
+    expect(statSync(path).mode & 0o777).toBe(0o600);
+  });
+});

package/src/orchestrator/host-process-orchestrator.ts

@@ -289,7 +289,7 @@ export class HostProcessOrchestrator implements Orchestrator {
         ports,
         owner: false,
         buildConfig: () => this.buildChildConfig(request, workdir, push),
-        extraArgs: ['--identity-protobuf', identity.path],
+        extraArgs: ['--identity-file', identity.path],
         ...(extraEnv ? { extraEnv } : {}),
         ...(request.resources?.memoryLimit ? { memoryLimit: request.resources.memoryLimit } : {}),
       });
@@ -399,7 +399,7 @@ export class HostProcessOrchestrator implements Orchestrator {
    * orchestrator restart) can re-spawn it without re-supplying them.
    *
    * The owner node is spawned as `cadre-cli start --owner
-   * --admin-port <p> --identity-protobuf <identityPath>` so it carries the
+   * --admin-port <p> --identity-file <identityPath>` so it carries the
    * host's libp2p identity, founds/joins the control network, and exposes the
    * loopback admin channel the manager delegates to.
    */
@@ -441,7 +441,7 @@ export class HostProcessOrchestrator implements Orchestrator {
         ports,
         owner: true,
         buildConfig: (workdir) => this.buildOwnerChildConfig(config, profile, workdir, push),
-        extraArgs: ['--owner', '--admin-port', String(ports.admin), '--identity-protobuf', config.identityPath],
+        extraArgs: ['--owner', '--admin-port', String(ports.admin), '--identity-file', config.identityPath],
       });
       const handle = this.handles.get(result.dockerId)!;
       return toNodeInfo(handle);
@@ -564,6 +564,11 @@ export class HostProcessOrchestrator implements Orchestrator {
       CADRE_HEALTH_PORT: String(ports.health),
       CADRE_METRICS_PORT: String(ports.metrics),
       CADRE_LISTEN_ADDRS: `/ip4/0.0.0.0/tcp/${ports.p2p}`,
+      // NOTE: the scrub above drops every CADRE_* var and `extraEnv` is built only from
+      // pinnedOwnerKeys, so a managed child advertises only the port assigned to it here
+      // — `CADRE_ANNOUNCE_ADDRS`/`CADRE_APPEND_ANNOUNCE_ADDRS` cannot reach it. Fine while
+      // children are reached at that port or through a relay; if a host is ever fronted by
+      // a proxy or DNS name, plumb an announce var through from host config.
       CADRE_SEED_TOKEN: seedToken,
       // Pin each child's node-local state (trusted-owner anchor, retained
       // cold-start dial targets) to its OWN workdir. This is the same value the
@@ -950,7 +955,7 @@ export class HostProcessOrchestrator implements Orchestrator {
    * docs/cadre-host.md § Two roles: donor and founder). It founds/joins the
    * control network for the host's own `partyId` (no bootstrap peers — it is the
    * founding node of the host's *own* cadre) and carries the host identity via
-   * `--identity-protobuf` (passed as a spawn arg).
+   * `--identity-file` (passed as a spawn arg).
    *
    * This is NOT the node cadre-host donates to a requester. Donated nodes are
    * generic (`createContainer` / `buildChildConfig`): they join the

package/src/orchestrator/index.ts

@@ -1,10 +1,10 @@
-export { HostProcessOrchestrator, OWNER_CONTAINER_ID } from './host-process-orchestrator.js';
-export type { OwnerAdminEndpoint } from './host-process-orchestrator.js';
-export type {
-  HostProcessConfig,
-  ManagedNodeInfo,
-  NodeStateListener,
-  NodePorts,
-  OwnerSpawnConfig,
-} from './types.js';
-export type { PersistedHandle } from './state-store.js';
+export { HostProcessOrchestrator, OWNER_CONTAINER_ID } from './host-process-orchestrator.js';
+export type { OwnerAdminEndpoint } from './host-process-orchestrator.js';
+export type {
+  HostProcessConfig,
+  ManagedNodeInfo,
+  NodeStateListener,
+  NodePorts,
+  OwnerSpawnConfig,
+} from './types.js';
+export type { PersistedHandle } from './state-store.js';